Security Report vulnerabilities privately. In scope: CI/CD pipelines, signing/attestation, update automation agents, registry metadata.